@capybara-hq/kernel 0.1.0-rc.11 → 0.1.0-rc.13

package/dist/catalog/component-scope.controller.js

@@ -9,6 +9,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { Controller, Get, HttpCode, Inject, Post, Put, Req } from "@nestjs/common";
 import { ApiError } from "../errors.js";
+import { orgIconScope, PluginIcons } from "../extensions/plugin-icons.js";
 import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZParam, ZQuery } from "../infra/validation/zod-params.js";
@@ -36,6 +37,16 @@ class ComponentShownBody extends createZodDto(ShownBody, "ComponentShownBody") {
 }
 class ComponentSwitchBody extends createZodDto(SwitchBody, "ComponentSwitchBody") {
 }
+/**
+ * Each component with `icon`: its plugin's icon URL on the reader's route (null without one, for
+ * a component without a plugin, or when the reader may not see the plugin; maintainer decision
+ * 2026-11-09: a connector template without an icon of its own shows its plugin's).
+ */
+async function withIcons(icons, rows, scope) {
+    const ids = rows.flatMap((r) => (r.itemId === null ? [] : [r.itemId]));
+    const urls = await icons.ofItems(ids, scope);
+    return rows.map((r) => ({ ...r, icon: r.itemId === null ? null : (urls.get(r.itemId) ?? null) }));
+}
 const actorOpts = (actor) => {
     const tokenId = patTokenId(actor);
     return tokenId !== undefined ? { actorTokenId: tokenId } : {};
@@ -49,9 +60,11 @@ const actorOpts = (actor) => {
 let AdminComponentsController = class AdminComponentsController {
     scope;
     components;
-    constructor(scope, components) {
+    icons;
+    constructor(scope, components, icons) {
         this.scope = scope;
         this.components = components;
+        this.icons = icons;
     }
     /**
      * Updates a platform skill on its own (spec §7.2): the skill package (zip) as the raw body
@@ -73,9 +86,14 @@ let AdminComponentsController = class AdminComponentsController {
         const actor = requireUser(principal);
         return this.components.uploadAgentTemplateVersion({ accountId: actor.account.id, ...actorOpts(actor) }, p.id, body.content);
     }
-    /** `GET ?kind=`: every platform component of the kind (plugin, owner, scope, version, orgs on). */
+    /**
+     * `GET ?kind=`: every platform component of the kind (plugin, owner, scope, version, orgs on),
+     * each with its display name and its plugin's icon (`icon`, the admin route; null without one).
+     */
     async list(q) {
-        return { components: await this.scope.list(q.kind) };
+        return {
+            components: await withIcons(this.icons, await this.scope.list(q.kind), { kind: "admin" }),
+        };
     }
     /**
      * A component's versions, newest first: `{ versions: [{ version, catalogVersion, updatedOnOwn,
@@ -178,7 +196,8 @@ AdminComponentsController = __decorate([
     Controller("api/v1/admin/components"),
     SuperAdmin(),
     __param(0, Inject(ComponentScopeService)),
-    __param(1, Inject(PlatformComponents))
+    __param(1, Inject(PlatformComponents)),
+    __param(2, Inject(PluginIcons))
 ], AdminComponentsController);
 export { AdminComponentsController };
 /**
@@ -189,21 +208,24 @@ export { AdminComponentsController };
  */
 let OrgComponentsController = class OrgComponentsController {
     scope;
-    constructor(scope) {
+    icons;
+    constructor(scope, icons) {
         this.scope = scope;
+        this.icons = icons;
     }
     /**
      * The platform components offered to the org (`?kind=`, `?itemId=`: only those; Task 10): each
      * with its state in the org (`on`, `locked` for `all`, the org's `switch`) and whether an org
-     * admin may switch it. Members read it (the workspace pages are read-only for them).
+     * admin may switch it. Members read it (the workspace pages are read-only for them). Each has
+     * its display name and `icon`, its plugin's icon on the org's catalog route (null without one,
+     * or when the org's catalog does not show the plugin to the reader: the share gate holds).
      */
     async list(org, q) {
-        return {
-            components: await this.scope.orgList(org.orgId, {
-                ...(q.kind !== undefined && { kind: q.kind }),
-                ...(q.itemId !== undefined && { itemId: q.itemId }),
-            }),
-        };
+        const rows = await this.scope.orgList(org.orgId, {
+            ...(q.kind !== undefined && { kind: q.kind }),
+            ...(q.itemId !== undefined && { itemId: q.itemId }),
+        });
+        return { components: await withIcons(this.icons, rows, orgIconScope(org)) };
     }
     async setSwitch(principal, org, p, body) {
         const actor = requireUser(principal);
@@ -229,6 +251,7 @@ __decorate([
 ], OrgComponentsController.prototype, "setSwitch", null);
 OrgComponentsController = __decorate([
     Controller("api/v1/orgs/:orgId/components"),
-    __param(0, Inject(ComponentScopeService))
+    __param(0, Inject(ComponentScopeService)),
+    __param(1, Inject(PluginIcons))
 ], OrgComponentsController);
 export { OrgComponentsController };

package/dist/catalog/component-scope.service.d.ts

@@ -68,7 +68,13 @@ export type ComponentTarget = {
 export interface ComponentView {
     kind: ComponentKind;
     id: string;
+    /** Skill or template name; a connector template's id (the file's base name). */
     name: string;
+    /** A connector template's localized display name (null: show `name`). */
+    displayName: {
+        zh: string;
+        en: string;
+    } | null;
     description: string | null;
     /** The plugin it came from (null: none). */
     plugin: string | null;
@@ -138,6 +144,11 @@ export interface OrgComponentView {
  * show with their switches. Never a component the org cannot see.
  */
 export interface OrgOfferedComponentView extends OrgComponentView {
+    /** A connector template's localized display name (null: show `name`). */
+    displayName: {
+        zh: string;
+        en: string;
+    } | null;
     description: string | null;
     itemId: string | null;
     version: string;

package/dist/catalog/component-scope.service.js

@@ -204,6 +204,7 @@ let ComponentScopeService = class ComponentScopeService {
                 kind,
                 id: c.id,
                 name: c.name,
+                displayName: c.displayName,
                 description: c.description,
                 plugin: c.plugin,
                 itemId: c.itemId,
@@ -258,6 +259,7 @@ let ComponentScopeService = class ComponentScopeService {
                     kind,
                     id: c.id,
                     name: c.name,
+                    displayName: c.displayName,
                     description: c.description,
                     plugin: c.plugin,
                     itemId: c.itemId,
@@ -360,6 +362,7 @@ let ComponentScopeService = class ComponentScopeService {
             kind,
             id: r.id,
             name: r.name,
+            displayName: null,
             description: r.description,
             plugin: r.plugin,
             itemId: r.catalog_item_id,
@@ -1084,6 +1087,7 @@ const virtualOf = (o) => ({
     plugin: o.plugin,
     version: String(o.version),
     description: null,
+    displayName: null,
     itemId: null,
     scopeMode: "own",
     scope: "named",

package/dist/catalog/component-state.d.ts

@@ -68,6 +68,14 @@ export interface ComponentRow extends ComponentScopeFacts {
     /** The current version (a connector template: the catalog version that last changed it). */
     version: string;
     description: string | null;
+    /**
+     * A connector template's localized display name (its file's `displayName`); null for skills and
+     * agent templates, whose name is what they are shown by.
+     */
+    displayName: {
+        zh: string;
+        en: string;
+    } | null;
     shownToOthers: boolean;
     /** The owning org (null: the platform; ruling P3-1). */
     ownerOrgId: string | null;

package/dist/catalog/component-state.js

@@ -63,6 +63,11 @@ export function componentOffered(c, p, listed) {
 export function componentLocked(_c, p) {
     return p?.builtin === true;
 }
+/** A `{ zh, en }` display name from stored JSON (a template file's), else null. */
+function localizedName(v) {
+    const n = v;
+    return typeof n?.zh === "string" && typeof n.en === "string" ? { zh: n.zh, en: n.en } : null;
+}
 /** The live platform components of `kind` (`ids` / `itemId`: only those). */
 export async function loadComponents(db, kind, filter = {}) {
     if (filter.ids !== undefined && filter.ids.length === 0)
@@ -105,17 +110,19 @@ export async function loadComponents(db, kind, filter = {}) {
             q = q.where("p.template_id", "=", filter.name);
         if (filter.forUpdate)
             q = q.forUpdate("p");
-        return (await q.orderBy("p.id").execute()).map((r) => ({
-            ...common(r),
-            ...(r.file?.defaultEnabled === false && {
-                defaultOff: true,
-            }),
-            name: r.template_id,
-            plugin: r.item_name,
-            version: r.current_version,
-            description: null,
-            originOrgId: null,
-        }));
+        return (await q.orderBy("p.id").execute()).map((r) => {
+            const file = r.file;
+            return {
+                ...common(r),
+                ...(file?.defaultEnabled === false && { defaultOff: true }),
+                name: r.template_id,
+                plugin: r.item_name,
+                version: r.current_version,
+                description: typeof file?.description === "string" ? file.description : null,
+                displayName: localizedName(file?.displayName),
+                originOrgId: null,
+            };
+        });
     }
     const table = kind === "skill"
         ? "platform_skills"
@@ -154,6 +161,7 @@ export async function loadComponents(db, kind, filter = {}) {
         plugin: r.plugin_name,
         version: String(r.current_version),
         description: r.description,
+        displayName: null,
         originOrgId: r.origin_org_id,
     }));
 }

package/dist/catalog/marketplaces.service.d.ts

@@ -188,7 +188,7 @@ export declare function headsToResolve(entries: readonly MarketplaceEntry[], imp
 /** The host versions (an entry's `minKernel` is judged against them). */
 export declare const HOST_VERSIONS: {
     readonly kernel: string;
-    readonly sdk: "0.1.0-rc.8";
+    readonly sdk: "0.1.0-rc.9";
 };
 /** Whether this deployment satisfies the entry's `minKernel`. */
 export declare const entryCompatible: (e: Pick<MarketplaceEntry, "minKernel">) => boolean;

package/dist/catalog/plugin-import.js

@@ -1714,7 +1714,10 @@ function actionOf(s, sha256, version) {
 export function pluginReviewHash(r, files) {
     const e = r.extension;
     const lic = r.licenseText;
-    const canonical = JSON.stringify([
+    // canonicalJson, not JSON.stringify: the review is stored as jsonb, which reorders object keys,
+    // so a template's auth / endpoint object would hash differently at confirm (plugin.review_stale
+    // on every import of a plugin whose connector template has a non-trivial auth block).
+    const canonical = canonicalJson([
         r.name,
         r.version,
         r.contentDigest,

package/dist/channels/channels.module.js

@@ -12,7 +12,7 @@ import { OnWorkerEvent, WorkerHost } from "@nestjs/bullmq";
 import { Inject, Injectable, Module } from "@nestjs/common";
 import { ConversationsModule } from "../conversations/conversations.module.js";
 import { EventLogModule } from "../conversations/event-log.js";
-import { EnvironmentsModule } from "../environments/environments.module.js";
+import { DevicesModule } from "../devices/devices.module.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { IdentityModule } from "../identity/identity.module.js";
 import { configuredProcessor, } from "../infra/queue/configured-processor.js";
@@ -39,7 +39,7 @@ let ChannelsModule = class ChannelsModule {
 ChannelsModule = __decorate([
     Module({
         imports: [
-            EnvironmentsModule,
+            DevicesModule,
             EventLogModule,
             ExtensionsModule,
             IdentityModule,

package/dist/channels/inbound.d.ts

@@ -1,7 +1,7 @@
 import type { ChannelCard, InboundEvent, InboundSender, Logger } from "@capybara-hq/plugin-sdk";
 import type { Redis } from "ioredis";
 import { ConversationsService } from "../conversations/conversations.service.js";
-import { EnvironmentsService } from "../environments/environments.service.js";
+import { DevicesService } from "../devices/devices.service.js";
 import { IdentityBinding } from "../identity/binding.js";
 import { ExternalIdentities } from "../identity/external.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -63,7 +63,7 @@ export declare class ChannelInbound {
     /** The channel queue: inbound jobs (`onEvent` only dedupes and enqueues) and deliveries. */
     private readonly jobs;
     private readonly guests;
-    private readonly environments;
+    private readonly devices;
     private readonly log;
     private readonly actions;
     constructor(kdb: KernelDb, redis: Pick<Redis, "set">, 
@@ -74,7 +74,7 @@ export declare class ChannelInbound {
     /** The channel queue: inbound jobs (`onEvent` only dedupes and enqueues) and deliveries. */
     jobs: Pick<ChannelJobs, "enqueue" | "enqueueInbound">, 
     /** 卡片操作：审批决定与提问回答（授权由这两个服务按点击者映射到的账号判定）。 */
-    approvals: Pick<ApprovalsService, "decide">, questions: Pick<QuestionsService, "answer">, guests: Pick<AnonymousGuests, "ensure">, environments: Pick<EnvironmentsService, "list" | "imDefault" | "setImDefault">, log: Pick<Logger, "warn" | "info">);
+    approvals: Pick<ApprovalsService, "decide">, questions: Pick<QuestionsService, "answer">, guests: Pick<AnonymousGuests, "ensure">, devices: Pick<DevicesService, "list" | "imDefault" | "setImDefault">, log: Pick<Logger, "warn" | "info">);
     /**
      * 插件 `onEvent`：去重并入队后返回（见类注释）。返回后插件才向平台确认；抛错时插件不确认。
      */
@@ -95,13 +95,13 @@ export declare class ChannelInbound {
     handle(connectionId: string, e: InboundEvent): Promise<void>;
     private message;
     /**
-     * Direct-message `/env` (environments spec §4.2 item 8): lists the person's usable environments,
+     * Direct-message `/device` (environments spec §4.2 item 8): lists the person's usable devices,
      * or with a name sets the IM default their next new conversation is bound to. The name matches
-     * case-insensitively against each label (`environmentLabel`: a former default demoted by a
-     * provider switch answers to e.g. "Personal (Docker sandbox)"); the default environment also
-     * answers to 个人环境 / Personal.
+     * case-insensitively against each label (`deviceLabel`: a former default demoted by a
+     * provider switch answers to e.g. "Personal (Docker sandbox)"); the default device also
+     * answers to 个人设备 / Personal.
      */
-    private envCommand;
+    private deviceCommand;
     /**
      * Posts the person's message: `/name args` as a skill invocation when the kernel accepts it, else
      * as typed (phase D spec §9). A retry of the job finds the first write by `clientMessageId`

package/dist/channels/inbound.js

@@ -11,8 +11,8 @@ import { randomUUID } from "node:crypto";
 import { Inject, Injectable } from "@nestjs/common";
 import { ConversationsService } from "../conversations/conversations.service.js";
 import { imSenderContext, recipientLocale, } from "../conversations/message-context.js";
-import { EnvironmentsService } from "../environments/environments.service.js";
-import { DEFAULT_ENVIRONMENT_ALIASES, environmentLabel } from "../environments/label.js";
+import { DevicesService } from "../devices/devices.service.js";
+import { DEFAULT_DEVICE_ALIASES, deviceLabel } from "../devices/label.js";
 import { ApiError } from "../errors.js";
 import { IdentityBinding } from "../identity/binding.js";
 import { ExternalIdentities } from "../identity/external.js";
@@ -75,7 +75,7 @@ let ChannelInbound = class ChannelInbound {
     directorySync;
     jobs;
     guests;
-    environments;
+    devices;
     log;
     actions;
     constructor(kdb, redis, 
@@ -86,7 +86,7 @@ let ChannelInbound = class ChannelInbound {
     /** The channel queue: inbound jobs (`onEvent` only dedupes and enqueues) and deliveries. */
     jobs, 
     /** 卡片操作：审批决定与提问回答（授权由这两个服务按点击者映射到的账号判定）。 */
-    approvals, questions, guests, environments, log) {
+    approvals, questions, guests, devices, log) {
         this.kdb = kdb;
         this.redis = redis;
         this.locks = locks;
@@ -97,7 +97,7 @@ let ChannelInbound = class ChannelInbound {
         this.directorySync = directorySync;
         this.jobs = jobs;
         this.guests = guests;
-        this.environments = environments;
+        this.devices = devices;
         this.log = log;
         this.actions = new ChannelCardActions({
             get db() {
@@ -216,16 +216,16 @@ let ChannelInbound = class ChannelInbound {
             await reply("newConversation");
             return;
         }
-        const envCommand = !isGroup && threadAccount !== null ? parseEnvCommand(e.text) : null;
-        if (envCommand !== null) {
-            await this.envCommand(row.orgId, accountId, envCommand.name, locale, replyText);
+        const deviceCommand = !isGroup && threadAccount !== null ? parseDeviceCommand(e.text) : null;
+        if (deviceCommand !== null) {
+            await this.deviceCommand(row.orgId, accountId, deviceCommand.name, locale, replyText);
             return;
         }
         let conversationId = await findThread(db, k);
         if (conversationId === undefined) {
             let created;
             try {
-                // bound to the person's IM default environment, else their default (environments spec
+                // bound to the person's IM default device, else their default (environments spec
                 // §4.2 item 8); an anonymous sender's stays unbound (no sandbox)
                 created = (await this.conversations.create(row.orgId, accountId, row.agentId, { im: true }))
                     .id;
@@ -294,49 +294,49 @@ let ChannelInbound = class ChannelInbound {
         await this.jobs.enqueue(conversationId);
     }
     /**
-     * Direct-message `/env` (environments spec §4.2 item 8): lists the person's usable environments,
+     * Direct-message `/device` (environments spec §4.2 item 8): lists the person's usable devices,
      * or with a name sets the IM default their next new conversation is bound to. The name matches
-     * case-insensitively against each label (`environmentLabel`: a former default demoted by a
-     * provider switch answers to e.g. "Personal (Docker sandbox)"); the default environment also
-     * answers to 个人环境 / Personal.
+     * case-insensitively against each label (`deviceLabel`: a former default demoted by a
+     * provider switch answers to e.g. "Personal (Docker sandbox)"); the default device also
+     * answers to 个人设备 / Personal.
      */
-    async envCommand(orgId, accountId, name, locale, replyText) {
-        const { items, defaultId } = await this.environments.list(orgId, accountId);
+    async deviceCommand(orgId, accountId, name, locale, replyText) {
+        const { items, defaultId } = await this.devices.list(orgId, accountId);
         const usable = items.filter((v) => v.available);
-        const labelOf = (v) => environmentLabel(v, locale);
-        const current = (await this.environments.imDefault(orgId, accountId)) ?? defaultId;
+        const labelOf = (v) => deviceLabel(v, locale);
+        const current = (await this.devices.imDefault(orgId, accountId)) ?? defaultId;
         const list = usable
-            .map((v) => `- ${labelOf(v)}${v.id === current ? phrase("envCurrent", locale) : ""}`)
+            .map((v) => `- ${labelOf(v)}${v.id === current ? phrase("deviceCurrent", locale) : ""}`)
             .join("\n");
         const fill = (key, vars) => phrase(key, locale).replace(/\{(\w+)\}/g, (m, k) => vars[k] ?? m);
         if (usable.length === 0)
-            return replyText(phrase("envNone", locale));
+            return replyText(phrase("deviceNone", locale));
         if (name === null)
-            return replyText(fill("envList", { list }));
+            return replyText(fill("deviceList", { list }));
         const wanted = name.toLowerCase();
         const is = (v) => labelOf(v).toLowerCase() === wanted;
         // a name the person gave wins over a generated label, and both over the default's aliases
         const hit = usable.find((v) => v.name !== null && is(v)) ??
             usable.find(is) ??
-            usable.find((v) => v.isDefault && DEFAULT_ENVIRONMENT_ALIASES.includes(wanted));
+            usable.find((v) => v.isDefault && DEFAULT_DEVICE_ALIASES.includes(wanted));
         if (hit === undefined) {
             const unavailable = items.find((v) => !v.available && is(v));
             if (unavailable !== undefined) {
-                return replyText(fill("envUnavailable", { name: labelOf(unavailable), list }));
+                return replyText(fill("deviceUnavailable", { name: labelOf(unavailable), list }));
             }
-            return replyText(fill("envUnknown", { name, list }));
+            return replyText(fill("deviceUnknown", { name, list }));
         }
         try {
-            await this.environments.setImDefault(orgId, accountId, hit.id);
+            await this.devices.setImDefault(orgId, accountId, hit.id);
         }
         catch (err) {
             // deleted or made unusable since the list was read
-            if (err instanceof ApiError && err.code.startsWith("environment.")) {
-                return replyText(fill("envUnknown", { name, list }));
+            if (err instanceof ApiError && err.code.startsWith("device.")) {
+                return replyText(fill("deviceUnknown", { name, list }));
             }
             throw err;
         }
-        return replyText(fill("envSwitched", { name: labelOf(hit) }));
+        return replyText(fill("deviceSwitched", { name: labelOf(hit) }));
     }
     /**
      * Posts the person's message: `/name args` as a skill invocation when the kernel accepts it, else
@@ -464,13 +464,13 @@ ChannelInbound = __decorate([
     __param(9, Inject(ApprovalsService)),
     __param(10, Inject(QuestionsService)),
     __param(11, Inject(AnonymousGuests)),
-    __param(12, Inject(EnvironmentsService)),
+    __param(12, Inject(DevicesService)),
     __param(13, Inject(KERNEL_LOGGER))
 ], ChannelInbound);
 export { ChannelInbound };
-/** `/env` or `/env <name>` (the exact command word, case-insensitive); anything else is null. */
-function parseEnvCommand(text) {
-    const m = /^\/env(?:\s+([\s\S]*))?$/i.exec(text.trim());
+/** `/device` or `/device <name>` (the exact command word, case-insensitive); anything else is null. */
+function parseDeviceCommand(text) {
+    const m = /^\/device(?:\s+([\s\S]*))?$/i.exec(text.trim());
     if (m === null)
         return null;
     const name = m[1]?.trim();

package/dist/channels/phrases.d.ts

@@ -11,33 +11,33 @@ export declare const CHANNEL_PHRASES: {
         readonly zh: "已开始新对话";
         readonly en: "Started a new conversation.";
     };
-    /** 私聊 `/env`：列出可用环境（`{list}` 每行一个，当前的带标记）。 */
-    readonly envList: {
-        readonly zh: "你的环境：\n{list}\n发送 /env <名称> 选择下一个新对话使用的环境。";
-        readonly en: "Your environments:\n{list}\nSend /env <name> to choose the one your next new conversation uses.";
-    };
-    /** 私聊 `/env <名称>` 之后（`{name}` 是环境名）。 */
-    readonly envSwitched: {
-        readonly zh: "下一个新对话将使用环境「{name}」，发送 /new 开始。";
-        readonly en: "Your next new conversation will use the environment “{name}”; send /new to start one.";
-    };
-    /** 私聊 `/env <名称>` 没有匹配的可用环境（`{list}` 同 envList）。 */
-    readonly envUnknown: {
-        readonly zh: "没有找到名为「{name}」的环境。你的环境：\n{list}";
-        readonly en: "No environment named “{name}”. Your environments:\n{list}";
-    };
-    /** `/env <name>` names an existing environment that is unavailable now (`{list}` as in envList). */
-    readonly envUnavailable: {
-        readonly zh: "环境「{name}」当前不可用（它的文件由未启用的沙箱提供方保存）。你的环境：\n{list}";
-        readonly en: "The environment “{name}” is unavailable: its files are kept by a sandbox provider that is not active. Your environments:\n{list}";
-    };
-    /** 私聊 `/env` 时此人没有可用环境（部署没有云沙箱）。 */
-    readonly envNone: {
-        readonly zh: "你目前没有可用的环境。";
-        readonly en: "You have no usable environments.";
-    };
-    /** 环境列表里当前 IM 默认环境的标记。 */
-    readonly envCurrent: {
+    /** Direct message `/device`: lists the usable devices (`{list}` one per line, the current one marked). */
+    readonly deviceList: {
+        readonly zh: "你的设备：\n{list}\n发送 /device <名称> 选择下一个新对话使用的设备。";
+        readonly en: "Your devices:\n{list}\nSend /device <name> to choose the one your next new conversation uses.";
+    };
+    /** After a direct message `/device <name>` (`{name}` is the device's name). */
+    readonly deviceSwitched: {
+        readonly zh: "下一个新对话将使用设备「{name}」，发送 /new 开始。";
+        readonly en: "Your next new conversation will use the device “{name}”; send /new to start one.";
+    };
+    /** `/device <name>` matches no usable device (`{list}` as in deviceList). */
+    readonly deviceUnknown: {
+        readonly zh: "没有找到名为「{name}」的设备。你的设备：\n{list}";
+        readonly en: "No device named “{name}”. Your devices:\n{list}";
+    };
+    /** `/device <name>` names an existing device that is unavailable now (`{list}` as in deviceList). */
+    readonly deviceUnavailable: {
+        readonly zh: "设备「{name}」当前不可用（它的文件由未启用的沙箱提供方保存）。你的设备：\n{list}";
+        readonly en: "The device “{name}” is unavailable: its files are kept by a sandbox provider that is not active. Your devices:\n{list}";
+    };
+    /** Direct message `/device` when the person has no usable device (no cloud sandbox in the deployment). */
+    readonly deviceNone: {
+        readonly zh: "你目前没有可用的设备。";
+        readonly en: "You have no usable devices.";
+    };
+    /** The mark of the current IM default device in the device list. */
+    readonly deviceCurrent: {
         readonly zh: "（当前）";
         readonly en: " (current)";
     };

package/dist/channels/phrases.js

@@ -6,33 +6,33 @@
 export const CHANNEL_PHRASES = {
     /** 私聊 `/new` 之后。 */
     newConversation: { zh: "已开始新对话", en: "Started a new conversation." },
-    /** 私聊 `/env`：列出可用环境（`{list}` 每行一个，当前的带标记）。 */
-    envList: {
-        zh: "你的环境：\n{list}\n发送 /env <名称> 选择下一个新对话使用的环境。",
-        en: "Your environments:\n{list}\nSend /env <name> to choose the one your next new conversation uses.",
-    },
-    /** 私聊 `/env <名称>` 之后（`{name}` 是环境名）。 */
-    envSwitched: {
-        zh: "下一个新对话将使用环境「{name}」，发送 /new 开始。",
-        en: "Your next new conversation will use the environment \u201c{name}\u201d; send /new to start one.",
-    },
-    /** 私聊 `/env <名称>` 没有匹配的可用环境（`{list}` 同 envList）。 */
-    envUnknown: {
-        zh: "没有找到名为「{name}」的环境。你的环境：\n{list}",
-        en: "No environment named \u201c{name}\u201d. Your environments:\n{list}",
-    },
-    /** `/env <name>` names an existing environment that is unavailable now (`{list}` as in envList). */
-    envUnavailable: {
-        zh: "环境「{name}」当前不可用（它的文件由未启用的沙箱提供方保存）。你的环境：\n{list}",
-        en: "The environment \u201c{name}\u201d is unavailable: its files are kept by a sandbox provider that is not active. Your environments:\n{list}",
-    },
-    /** 私聊 `/env` 时此人没有可用环境（部署没有云沙箱）。 */
-    envNone: {
-        zh: "你目前没有可用的环境。",
-        en: "You have no usable environments.",
-    },
-    /** 环境列表里当前 IM 默认环境的标记。 */
-    envCurrent: { zh: "（当前）", en: " (current)" },
+    /** Direct message `/device`: lists the usable devices (`{list}` one per line, the current one marked). */
+    deviceList: {
+        zh: "你的设备：\n{list}\n发送 /device <名称> 选择下一个新对话使用的设备。",
+        en: "Your devices:\n{list}\nSend /device <name> to choose the one your next new conversation uses.",
+    },
+    /** After a direct message `/device <name>` (`{name}` is the device's name). */
+    deviceSwitched: {
+        zh: "下一个新对话将使用设备「{name}」，发送 /new 开始。",
+        en: "Your next new conversation will use the device \u201c{name}\u201d; send /new to start one.",
+    },
+    /** `/device <name>` matches no usable device (`{list}` as in deviceList). */
+    deviceUnknown: {
+        zh: "没有找到名为「{name}」的设备。你的设备：\n{list}",
+        en: "No device named \u201c{name}\u201d. Your devices:\n{list}",
+    },
+    /** `/device <name>` names an existing device that is unavailable now (`{list}` as in deviceList). */
+    deviceUnavailable: {
+        zh: "设备「{name}」当前不可用（它的文件由未启用的沙箱提供方保存）。你的设备：\n{list}",
+        en: "The device \u201c{name}\u201d is unavailable: its files are kept by a sandbox provider that is not active. Your devices:\n{list}",
+    },
+    /** Direct message `/device` when the person has no usable device (no cloud sandbox in the deployment). */
+    deviceNone: {
+        zh: "你目前没有可用的设备。",
+        en: "You have no usable devices.",
+    },
+    /** The mark of the current IM default device in the device list. */
+    deviceCurrent: { zh: "（当前）", en: " (current)" },
     /** 未绑定的人在私聊里发消息：附绑定卡片。 */
     bindPrompt: {
         zh: "请先绑定你的 Capybara 账号，再与我对话。",

package/dist/config/docs.js

@@ -82,7 +82,7 @@ export function renderConfigDocs(schema) {
         "| `CAPYBARA_WEB_OBJECT_STORE_URL` | Object storage on the web origin: the object store's address as web reaches it (e.g. `http://seaweedfs-s3:8333`). When set, web proxies `/<bucket>/**` (and `/<bucket>` itself for POST only) there, so browsers upload attachments (presigned POST) and download attachments and artifacts (presigned GET) through web; set the object-store extension's `publicEndpoint` to the web origin with `forcePathStyle: true`. Only GET, HEAD and POST; the path is forwarded unchanged; cookies and authorization are not forwarded; responses carry `X-Content-Type-Options: nosniff` and `Content-Security-Policy: sandbox`; uploads are capped at `CAPYBARA_WEB_MAX_PACKAGE_BYTES`. Unset (default): off |",
         "| `CAPYBARA_WEB_OBJECT_STORE_BUCKET` | With `CAPYBARA_WEB_OBJECT_STORE_URL`: the bucket, equal to the object-store extension's `bucket` (it is the first path segment web proxies) |",
         "| `CAPYBARA_WEB_OBJECT_STORE_PUBLIC_HOST` | With `CAPYBARA_WEB_OBJECT_STORE_URL`: the host of the extension's `publicEndpoint` (a host such as `capybara.example.com`, or that URL). Sent upstream as `Host` instead of the incoming one, because presigned URLs sign the host they were issued for and front proxies rewrite it |",
-        "| `CAPYBARA_WEB_GATEWAY_URL` | Connected machines on the web origin: a `gateway` replica's address as web reaches it (an http(s) URL, e.g. `http://gateway:8080`). WebSocket upgrades on exactly `/device/connect` are forwarded to it (`capybara-device` connects at `<http.publicUrl>/device/connect`). Unset, they go to `CAPYBARA_KERNEL_URL` (the kernel runs every role unless the deployment splits them), so only deployments with separate gateway replicas set it (compose does). A malformed value stops the web tier at startup |",
+        "| `CAPYBARA_WEB_GATEWAY_URL` | Local devices on the web origin: a `gateway` replica's address as web reaches it (an http(s) URL, e.g. `http://gateway:8080`). WebSocket upgrades on exactly `/device/connect` are forwarded to it (`capybara-device` connects at `<http.publicUrl>/device/connect`). Unset, they go to `CAPYBARA_KERNEL_URL` (the kernel runs every role unless the deployment splits them), so only deployments with separate gateway replicas set it (compose does). A malformed value stops the web tier at startup |",
         "| `CAPYBARA_DEV_UI` | When set to `1`, production builds also serve the `/dev/ui` component catalog page (off by default) |",
         "",
     ].join("\n");

package/dist/config/schema.d.ts

@@ -219,9 +219,9 @@ export declare const KernelConfigSchema: z.ZodObject<{
             allowHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
-    environments: z.ZodPrefault<z.ZodObject<{
+    devices: z.ZodPrefault<z.ZodObject<{
         maxPersonal: z.ZodDefault<z.ZodNumber>;
-        device: z.ZodPrefault<z.ZodObject<{
+        local: z.ZodPrefault<z.ZodObject<{
             reconnectGraceSeconds: z.ZodDefault<z.ZodNumber>;
             leaseTtlMs: z.ZodDefault<z.ZodNumber>;
             authCodeTtlSeconds: z.ZodDefault<z.ZodNumber>;